CVE-2026-29062: Fasterxml Jackson-core DoS Vulnerability

CVE-2026-29062 Overview

CVE-2026-29062 is a Denial of Service (DoS) vulnerability in jackson-core, the core low-level incremental ("streaming") parser and generator abstractions used by Jackson Data Processor. The vulnerability affects versions 3.0.0 to before 3.1.0, where the UTF8DataInputJsonParser and ReaderBasedJsonParser components bypass the maxNestingDepth constraint (default: 500) defined in StreamReadConstraints. This allows attackers to supply maliciously crafted JSON documents with excessive nesting that triggers a StackOverflowError when processed, causing application crashes and service disruption.

Critical Impact
Remote attackers can cause a complete Denial of Service by sending deeply nested JSON payloads to applications using vulnerable jackson-core versions, leading to application crashes via stack exhaustion without requiring authentication.

Affected Products

FasterXML jackson-core versions 3.0.0 to before 3.1.0
Applications parsing JSON from java.io.DataInput sources using UTF8DataInputJsonParser
Applications using ReaderBasedJsonParser for JSON parsing operations

Discovery Timeline

2026-03-06 - CVE CVE-2026-29062 published to NVD
2026-03-10 - Last updated in NVD database

Technical Details for CVE-2026-29062

Vulnerability Analysis

This vulnerability represents a Resource Exhaustion issue (CWE-770: Allocation of Resources Without Limits or Throttling) in the jackson-core library's JSON parsing components. The core problem lies in how certain parser implementations handle nesting depth validation. While StreamReadConstraints provides a configurable maxNestingDepth setting intended to prevent stack overflow attacks from deeply nested JSON structures, two specific parser classes—UTF8DataInputJsonParser and ReaderBasedJsonParser—fail to properly enforce this constraint.

When an application receives a JSON document with nesting levels exceeding stack capacity, the parser recursively processes the nested structure without checking against the configured maximum depth. This recursive processing eventually exhausts the call stack, resulting in a StackOverflowError that terminates the processing thread or crashes the entire application.

The network-accessible nature of this vulnerability makes it particularly concerning for web applications and APIs that accept JSON input from untrusted sources. An attacker requires no authentication or special privileges to exploit this flaw—they simply need to send a crafted JSON payload to any endpoint that processes JSON using the vulnerable parsing methods.

Root Cause

The root cause is a missing validation check in the UTF8DataInputJsonParser and ReaderBasedJsonParser classes. Unlike other parser implementations in jackson-core that properly validate nesting depth against StreamReadConstraints.maxNestingDepth, these two parsers process nested JSON structures recursively without enforcing the configured depth limit. This oversight allows the nesting depth constraint to be completely bypassed, making the configured protection ineffective for applications using DataInput or Reader-based input sources.

Attack Vector

The attack vector is network-based, requiring no user interaction, privileges, or authentication. An attacker can exploit this vulnerability by:

Identifying an application endpoint that accepts JSON input and uses jackson-core 3.0.x for parsing
Crafting a JSON document with deeply nested arrays or objects (e.g., thousands of nested brackets)
Sending the malicious payload to the target endpoint
The vulnerable parser attempts to process the nested structure recursively
Stack space becomes exhausted, triggering a StackOverflowError
The processing thread crashes, potentially bringing down the entire application or service

The attack is straightforward to execute and can be repeated to maintain a persistent denial of service condition. A malicious JSON payload would consist of thousands of opening brackets followed by corresponding closing brackets, such as deeply nested empty arrays or objects that exceed the stack depth capacity of the JVM.

Detection Methods for CVE-2026-29062

Indicators of Compromise

Sudden StackOverflowError exceptions appearing in application logs during JSON parsing operations
Repeated application or thread crashes when processing JSON input from external sources
Abnormally large JSON payloads with unusual character patterns (many consecutive [ or { characters)
Service degradation or unavailability coinciding with JSON processing requests

Detection Strategies

Monitor application logs for StackOverflowError exceptions, particularly in threads handling JSON parsing
Implement payload size and character pattern analysis at the network or WAF level to detect malicious nesting patterns
Use dependency scanning tools to identify jackson-core versions between 3.0.0 and 3.1.0 in your software inventory
Configure APM tools to alert on abnormal thread terminations in JSON processing components

Monitoring Recommendations

Implement real-time alerting for StackOverflowError occurrences in production environments
Monitor thread pool health and track unexpected thread deaths in application servers
Establish baseline metrics for JSON payload sizes and nesting depths to detect anomalies
Deploy network-level monitoring to identify requests with unusually large or deeply nested JSON structures

How to Mitigate CVE-2026-29062

Immediate Actions Required

Upgrade jackson-core to version 3.1.0 or later immediately
Audit your codebase to identify all locations using UTF8DataInputJsonParser or ReaderBasedJsonParser
Implement input validation at the application boundary to reject excessively nested JSON before it reaches the parser
Consider implementing request size limits at the web server or API gateway level as an additional defense layer

Patch Information

FasterXML has addressed this vulnerability in jackson-core version 3.1.0. The fix properly enforces the maxNestingDepth constraint in both UTF8DataInputJsonParser and ReaderBasedJsonParser classes. Organizations should update their Maven or Gradle dependencies to use jackson-core 3.1.0 or later.

For detailed information about the fix, refer to:

Workarounds

Implement application-level input validation to count and reject JSON with excessive nesting before parsing
Configure Web Application Firewalls (WAF) to inspect JSON payloads and block those with suspicious nesting patterns
Apply request body size limits at the reverse proxy or load balancer level to reduce attack surface
Increase JVM stack size as a temporary mitigation (note: this only delays exhaustion, does not prevent the attack)

bash

# Maven dependency update example
# Update pom.xml to use patched version
# Change:
#   <dependency>
#     <groupId>com.fasterxml.jackson.core</groupId>
#     <artifactId>jackson-core</artifactId>
#     <version>3.0.x</version>
#   </dependency>
# To:
#   <dependency>
#     <groupId>com.fasterxml.jackson.core</groupId>
#     <artifactId>jackson-core</artifactId>
#     <version>3.1.0</version>
#   </dependency>

# Verify updated dependency
mvn dependency:tree | grep jackson-core